A declaration issued by France on 9 November lays out a shared agenda for evaluating frontier AI, disclosing risks, creating fail-safe shutdown mechanisms and sharing incident warnings. The text is verifiable; the precise roster of endorsers is not. The Élysée page lists a broader set of governments and organizations than accounts published by The Next Web and The Decoder, and those discrepancies should not be collapsed into a definitive headcount. The declaration is also a political commitment, not a new international enforcement regime: it sets no timetable, sanctions or public-authority shutdown power.

Contents

What the declaration actually says

The French Presidency’s published text describes the Paris Call for AI Safety and Security as a framework for cooperation around frontier models, whose development and impacts cross borders. It identifies three priorities: a common evaluation and risk-management approach; responsibility and accountability across the AI ecosystem; and information sharing, incident reporting and early warning.

That three-part structure matters because it is more than a generic statement that safety is desirable, but less than an operational treaty. The document describes work and practices that signatories commit to advance. It does not itself define a shared legal code, specify a regulator, or create a system of penalties. The distinction between a written commitment and an enforceable obligation is especially important when describing shutdown pledges: the declaration’s force should not be overstated.

The text grounds its proposal in prior international discussions, naming the Hiroshima process, the Seoul AI Summit’s Frontier Safety Commitments, the G7 Evian AI meeting, a United Nations Security Council meeting on AI and the “Call for Control of Frontier AI Models.” Its argument is that no single government, company or international organization can manage these risks alone. The practical aim is coordination between policymakers, researchers and developers rather than a claim that one global authority already exists.

A common evaluation framework, still to be built

Under the first commitment, policymakers, researchers and developers say they will establish a common framework for evaluating and managing risks from frontier models, building on existing frameworks. The proposed work includes shared technical standards, tools and methods that keep pace with model capabilities. The text singles out dangerous misuse, including cyber and chemical, biological, radiological and nuclear domains, along with risks from growing autonomy or misalignment, including loss of control.

The declaration also points to technical cooperation and the International Network for Advanced AI Measurement, Evaluation and Science (NAAIMES), which it says can help make methods and results more comparable and accessible across regions. That is an institutional reference, not evidence that a global testing system is already functioning. The framework remains to be developed; the text does not establish which tests every developer must pass, who sets the thresholds, or what follows from a failed evaluation.

What would become public

Signatories say they will publish non-sensitive evaluation findings in a standardized format and create a publicly accessible shared repository. The examples include red-teaming protocols, benchmarking tools, risk assessments and stress-test results. Standardization could make it easier to compare evidence from different labs or jurisdictions, while a repository could give researchers and policymakers a common reference point.

But the qualifier “non-sensitive” leaves room for judgment about what may be withheld, and the declaration does not spell out a disclosure schedule, a compliance audit for the repository, or a process for resolving disputes about omissions. Public reporting is therefore a stated direction, not a guarantee that every model will be tested identically or that all results will be released. The Next Web reports that CeSIA sees no guarantee of evaluator access to models, an important distinction between publishing selected findings and permitting independent scrutiny of the underlying system.

Shutdown mechanisms under developer control

The second commitment emphasizes responsibility and accountability according to each actor’s role. The text says signatories will work toward strict compliance with rigorous safety standards established or recognized by competent national authorities, under those authorities’ oversight, and with credible, competent and independent third-party evaluation. It also says incentives can encourage safety from design through the model lifecycle.

For developers, the specific commitments include disclosing model capabilities, limitations and known risks; supporting qualified independent evaluation where appropriate and proportionate to risk; and implementing fail-safe mechanisms to shut down model operations “within their control.” The text explicitly includes training and internal use, giving restrictions, pauses and shutdowns as examples. These are substantive operational commitments, not merely promises to study the question. A lab that can halt an internal training run or suspend a controlled service has named a capability it says it will implement.

The limiting phrase is just as important as the pledge. It concerns operations under a developer’s control. The declaration does not say a company must be able to remotely disable every copy of a model after weights are released or transferred, nor does it establish a technical kill switch accessible to governments. It acknowledges the risks of safeguard removal or circumvention while also recognizing the potential benefits of open-weight development for research, innovation and safety. It does not resolve that tension with a blanket prohibition or specific technical standard.

Internal governance and alerts

Developers also recognize the importance of internal governance requiring continuous risk management, real-time monitoring of emergent capabilities, rigorous internal red-teaming, transparent reporting lines that protect researchers, defined responsibilities, adequate resources and independent oversight. The wording describes commitments to work on a clear governance structure. It does not list a uniform set of staffing levels, test frequency or consequences for inadequate governance.

The third pillar calls for rapid alert systems, building on relevant incident-response arrangements such as cybersecurity systems. The signatories agree on the value of strengthening existing reporting arrangements, aligning incident classification and sharing timely information about serious cyber and AI-control incidents and other material precursor signals of serious harm. The declaration contemplates exchanges among companies and governments, between governments, and among AI companies; it says parties will explore whether a cooperation mechanism would help and what its scope could be.

Policymakers also commit to offer secure, confidential channels where whistleblowers—including employees and other relevant stakeholders—can raise concerns about systemic risks on reasonable grounds without fear of legal or professional retaliation. As with other provisions, the declaration does not spell out a common reporting deadline, protected-disclosure procedure or enforcement mechanism. It establishes the intended direction and leaves much of the design to subsequent work.

Why the signatory roster remains unsettled

The central factual caution is a visible conflict among accounts. The Élysée page currently appends a roster naming heads of government from Austria, Bahrain, Canada, Croatia, Cyprus, Estonia, Finland, France, Ireland, Kenya, Latvia, Liechtenstein, Luxembourg, the Netherlands, Norway and Portugal; it also names ten companies and seven civil-society organizations. It says the statement remains open to new endorsements and is being updated.

By contrast, The Next Web’s 10 November report describes six countries as signatories—France, Canada, Finland, Norway, the Netherlands and Bahrain—and names a group of companies and research organizations. The Decoder’s 10 November report characterizes the participating governments as eight countries. These accounts cannot all describe the same final roster as published today. The official page’s explicit note that the list is being updated may explain why an earlier report differs, but the material provided does not establish when each endorsement was added or reconcile every version.

For that reason, this account does not state a definitive total or reproduce a supposedly complete list. The sources do converge on participation by major AI companies—including OpenAI, Anthropic, Microsoft and Mistral AI—and the Presidency’s current page names them. Still, any precise tally should be checked against a dated, versioned primary roster. A count at one point in the update process is not necessarily the count at another.

CeSIA’s criticism: commitment without thresholds

CeSIA is not merely an outside critic. Its own 10 November statement says the French nonprofit participated in the meeting and signed the Call. It welcomes a first step toward a common framework while asking signatories to make the commitments concrete, with formal developer obligations, a timetable and deliverables.

Its principal concern is the gap between evaluation and decisions that evaluation is meant to inform. CeSIA asks what level of risk should lead to suspending model development or abandoning deployment, and argues that those decisions must rest with public authorities relying on independent evaluations and guaranteed access to models. It says the declaration establishes no common risk thresholds, no clear guarantees of access for evaluators and authorities, and no public-authority-controlled suspension mechanism.

CeSIA therefore calls for common risk thresholds, mandatory and systematic independent evaluations with guaranteed model access, and powers for public authorities to suspend development or deployment when risks are unacceptable. This is an independent assessment by a signatory organization, not language contained in the declaration. Its critique also clarifies the distinction between a developer promising a shutdown mechanism for operations it controls and a public authority having power to order a shutdown. The text promises the former; it does not provide the latter.

The Next Web similarly reports that the Call supplies no common risk thresholds and that the framework has not yet been developed. These criticisms do not negate the stated commitments to testing, disclosures or fail-safes; they identify what those commitments leave open. The unresolved questions—access, thresholds, authority and consequences—are precisely where voluntary coordination may or may not mature into more specific governance.

Limits, timetable and what happens next

Neither the Presidency’s declaration nor the coverage reviewed sets a deadline for completing the shared evaluation framework. The Next Web says the Call has no deadlines and the proposed testing framework has yet to be developed. The Decoder characterizes the document as a political self-commitment and notes the absence of sanctions and a binding international oversight system. CeSIA likewise asks for a timetable and concrete deliverables, indicating that these are not supplied in the current text.

It would therefore be inaccurate to describe the pledges as legally binding or enforceable on the strength of these sources. The declaration uses commitment language and refers to safety standards established or recognized by competent national authorities, but it does not say that the Call itself creates domestic legal duties, specify a dispute process or provide penalties for non-compliance. National laws and existing regulatory obligations may apply independently; this text does not replace or comprehensively describe them.

The most defensible account is both substantive and provisional. The Call has articulated a cross-border agenda: comparable frontier-model evaluations, some public reporting, developer risk disclosures, proportionate independent assessment, fail-safe shutdown capability within developers’ control, stronger internal governance, incident alerts and protected channels for whistleblowers. Those are tangible policy directions. But shared thresholds, mandatory evaluator access, a regulator-led suspension power, sanctions, deadlines and a settled public roster remain absent or unresolved in the material examined.

That makes implementation—not the announcement’s signatory headline—the measure to watch. Subsequent publications could reveal whether the repository is built, whether methods are genuinely comparable, what information remains confidential, and whether evaluators receive access sufficient to test claims. Governments may also decide whether to translate the stated principles into domestic law. Until then, the Paris Call should be understood as a political coordination effort with concrete but incompletely specified commitments, not as proof that a unified international safety regime has already been created.

FAQ

What are the Paris Call’s three main commitments?

They are to develop common evaluation and risk-management practices for frontier models; strengthen responsibility and accountability, including developer disclosures and fail-safe shutdown mechanisms under their control; and improve information sharing, reporting and early-warning systems for serious incidents.

Does the declaration give governments a kill switch?

No. It says developers commit to implement fail-safe mechanisms to shut down model operations within their control, including during training and internal use. It does not establish a government-operated switch or a public-authority power to order suspension. CeSIA says that authority should be added.

How many signatories does it have?

The sources reviewed show conflicting counts and lists. The Élysée page’s roster is broader than the earlier counts reported by The Next Web and The Decoder, and the official page says endorsements are still being updated. A definitive total is not asserted here.

Are the commitments legally binding?

The declaration is framed as a political commitment and does not itself specify sanctions, deadlines or an international enforcement mechanism. This account does not characterize its pledges as legally binding or enforceable.

What does CeSIA want changed?

CeSIA calls for common risk thresholds, mandatory systematic independent evaluations with guaranteed access to models, and authority for public bodies to suspend development or deployment when risks are unacceptable. It also asks for a timetable and clearer deliverables.

References